For: anyone who has used Times Car, Times Business Service or Times Club in Japan — including people who left the service or only started an application — and anyone who runs a service that collects identity documents. This article is based on the operator's official notices and FAQ and does not cover attack techniques.
Developing: this article will be updated as the company publishes more
- Who is affected
anyone who has used Times Car, Times Business Service or Times Club in Japan — including people who left the service or only started an application — and anyone who runs a service that collects identity documents.
- Not yet confirmed
- Completion report for deleting identity-document images by the end of October, as the company said it would (no official follow-up found as of November 2)
- Details of the 3,000-yen payment and how it will be made (the company says it is still deciding and will contact eligible people)
- Information security and governance measures (to be published by the end of the year)
1 more
- Findings of the investigation committee led by outside directors
- What to do nowSee the steps ↓
- Ignore instructions in emails, texts, calls or letters claiming to be the company (everyone)
- Register a fraud alert with Japan's three credit bureaus (if your document images were sent out)
- Request your credit file and look for accounts you did not open (if your document images were sent out)
3 more
- Former members and people who never completed registration: inquire through the dedicated form, and request deletion if you wish
- Stop password reuse
- Corporate account admins: warn staff about emails impersonating partners
- Where to verify (source)All sources ↓
- Times Mobility Co., Ltd., fifth notice: report on the personal data leak caused by unauthorized access to the Times Car web system and next steps (October 23, 2026: final counts, Times Club web system, cause, payment, checking on My Page, Japanese)
- Last checked
- As of November 2, 2026 (the fifth notice is the latest)
Follow-up plans and what we checked
In its fifth notice on October 23, the company said the outside forensic investigation ended that day and published the final counts, the cause (exploitation of a vulnerability in the web system) and its payment policy. It says no further scope has been found so far. It will not publish details of the attack method or system configuration, to prevent further harm.
Check your own items on My Page
Since 17:00 on October 23, the company has shown, on each person's My Page on the Times Car website, the information confirmed leaked for that person. It has published the steps as a PDF (how to check, Japanese). Open My Page by signing in from the official app or an official site you open yourself (share.timescar.jp), not from a link in an email.
According to the FAQ, the emails sent earlier list what had been confirmed when each email was sent. Check the final result, after the investigation ended, on My Page. What to do depends on which of these applies to you.
| What you find (category in the fifth notice) | What the company says | What to do |
|---|---|---|
| Identity-document images with "traces of access and external transmission" (④, 1,464,800) | Encrypted images were sent out. This does not mean the content immediately became viewable, but future decryption cannot be fully ruled out. Eligible for the 3,000-yen payment | All the steps below, especially fraud alerts at the three credit bureaus and checking your credit file |
| Identity-document images "accessed, with no trace of external transmission" (⑤, 891,602) | The company considers the chance the content was viewed or obtained to be low. Not eligible for the payment | Watch for impersonation. Fraud alerts are optional |
| Name, address, date of birth, phone, email, driver's license information and so on (①, 6,628,007) | Items other than images. Includes people who signed up only for parking through "Kantan Nyukai" (paying by card) | Watch for impersonation. Corporate members should also watch for fake emails using department names |
| Times Club member | In the Times Club web system, Times Club card numbers (19,510), linked-service IDs (135,436), card last four digits (28) and more showed traces of being sent out (⑥) | Watch for impersonation. Ask the company's hotline whether you are affected (the fifth notice does not say how to check) |
| Former member, or never completed registration | Cannot be checked on My Page | Inquire through the dedicated form (replies in about two weeks, in turn) |
Notice emails are easy to fake: do not act through links in them
Fake emails imitating the real notices may appear. The company says in its FAQ that it never asks for SMS verification codes, internet service passwords, or the PINs of driver's licenses or My Number Cards by phone or email.
Since the fifth notice (October 23), and still as of November 2, the details of the payment and how it will be made have not been decided (the company will contact eligible people once decided). If a message about "receiving your payment" asks you to enter bank or card details, do not open its link; check yourself whether the same guidance appears in the news section of the official site (share.timescar.jp). The hotline is 0120-25-8924 (24 hours, Japan), or use the contact form on the official site.
According to the My Page display (as shown to an affected member on October 27, 2026), "driver's license information" means license number, license type and expiry date (excluding images). Internal identifiers for member management and system operation (management information used inside the company) are also shown as leaked items, with the note "registration information as of September 25, 2026" (our translation). The company's fifth notice and FAQ (October 23 version) do not say what the item includes. It is listed separately from document images.
What affected people should do today
Detailed steps to stop misuse of a leaked license are in a separate guide
How to register fraud alerts, how to spot fraudulent phone or loan contracts, and how to approach the police are covered in What to do when your driver's license image or number leaks. This article keeps to the points specific to this incident.
Ignore instructions in emails, texts, calls or letters claiming to be the company (everyone)
The leaked data combines name, address, date of birth, phone number and email address. With all of that, a scammer can write a convincing message.
If you are contacted about "compensation procedures", "re-submitting your license" or "re-registering your card", do not open the link; open the official app or site yourself. The company's FAQ also asks people not to respond to unfamiliar contacts and not to open links or attachments (see What is phishing?).
On October 6 the company added a warning to its FAQ about contacts claiming to be the company, financial institutions, phone carriers or public agencies that try to obtain SMS verification codes, IDs and passwords, bank details, credit card details or PINs. It says it never asks for SMS codes, passwords or the PINs of driver's licenses or My Number Cards by phone or email. It also said it has consulted the National Police Agency, and passes on the agency's warning about scam calls from people posing as police and the free anti-scam call apps the agency recommended. Do not answer on the spot; check with each company's official contact point yourself.
Register a fraud alert with Japan's three credit bureaus (if your document images were sent out)
A self-declaration can be registered when your name may be misused because an identity document was lost, stolen or leaked. Lenders and card issuers then see the note and review applications more carefully.
In its FAQ (Q12), the company explains that the system is used for credit decisions and not, for example, when opening a deposit account, and says it neither recommends nor guarantees it. This site's view is that, since future decryption of images that were sent out has not been ruled out, registering is worthwhile for those people.
Each bureau has different member companies, so registering with all three is the safest choice. Fees and methods are in the table below (checked on each bureau's official site on October 3, 2026).
Request your credit file and look for accounts you did not open (if your document images were sent out)
A fraud alert does not block applications. Use your credit file to confirm nothing was actually opened in your name.
Check once now and again a few months later for cards or loans you never applied for. If you receive an unfamiliar contract, a collection notice, or mail from a phone carrier or lender you never used, contact that company and your local police station.
Former members and people who never completed registration: inquire through the dedicated form, and request deletion if you wish
The company began contacting former members on October 1 but notes their registered contact details may no longer work. Former members and people who never completed registration cannot check on My Page, so the company asks them to inquire through the dedicated inquiry form (replies in about two weeks after you submit, in turn). The form is linked from the fifth notice: former-member inquiry form (Japanese).
In its fourth and fifth notices, the company said it will delete identity-document images by the end of October whether or not anyone asks. Its FAQ (updated October 23) still says name, address and date of birth are kept for seven years under the Corporation Tax Act and other laws, but adds that it will review retention rules for other data too. If you do not plan to use the service again, you can also ask about how that data is handled and request deletion (the legal basis is explained below).
Stop password reuse
According to the fifth notice, hashed passwords (converted into a form that cannot be turned back) showed traces of being sent out in 4 cases. Check on My Page whether you are one of them. Even if you are not, if you use your Times Car password on other services, changing it there is a sensible precaution. A password manager is the realistic way to do the inventory.
Corporate account admins: warn staff about emails impersonating partners
According to the fifth notice, corporate members' department names showed traces of being sent out in 3,677 cases. Name, department and email address together make it easier to impersonate a business partner or colleague.
Circulate a rule that requests such as "our bank account has changed" or "please review this urgently" are verified through another channel, such as a phone call (protecting your own domain: Email spoofing and SPF, DKIM, DMARC).
| Credit bureau | Main member companies | Online / app | By post | Alert valid for |
|---|---|---|---|---|
| CIC | Card issuers, consumer credit companies | 1,000 yen (you must call from a phone number used in a credit contract) | 1,000 yen (postal money order) | 5 years |
| JICC (Japan Credit Information Reference Center) | Consumer lenders and others | Smartphone app, 700 yen | 1,111 yen per comment type | 5 years |
| KSC (Japanese Bankers Association) | Banks and others | 500 yen (My Number Card required) | 2,403 yen | Check the official site |
The credit bureaus are congested: you can also apply by post
Applications surged after the disclosure. On September 30 CIC said online disclosure and fraud-alert reference numbers were hard to obtain and its phone lines were busy. JICC paused smartphone-app applications on October 1, resumed them on October 2, then stopped them again from 18:30 that day through October 4 for server maintenance (a restart time is to be announced).
A few days' delay is less risky than landing on a fake site. Apply from each bureau's official site, or by post if you cannot get through, and avoid "application service" sites reached from search ads or email links.
What happened (from Times Mobility's notices)
Times Mobility Co., Ltd., together with its parent Park24 Co., Ltd., published notices on September 25, 28 and 29, October 16 (fourth) and October 23 (fifth), 2026. Its FAQ was published on October 1 and updated on October 6, 13, 16 and 23. Everything below is as stated in the company's official notices.
Sep 25, 2026, 9:07
The company detected unauthorized external access to the Times Car web system and began investigating.Sep 25
First notice on a possible personal data leak; the company said it was reporting to the Personal Information Protection Commission, among other steps.By Sep 26, 7:25
The access route and communication with the attacker were cut off. The company confirmed access was no longer possible and continued monitoring.Sep 28
Second notice: data on about 6.6 million accounts was confirmed obtained by a third party. Reported to the commission and the police, and an initial report made to the Ministry of Land, Infrastructure, Transport and Tourism. Notices to existing members began (per the timeline in the fifth notice). Park24's stock-exchange disclosure said the impact on earnings was under review.Sep 29
Third notice: identity-document images leaked for about 1.6 million accounts. Notices to individual members began (per the timeline in the fifth notice).Oct 1
FAQ and a dedicated form for former members added. Individual notices to former members began. Individual members whose other information leaked also received emails.Oct 2
Notices to corporate members began (per the timeline in the fifth notice).Oct 6
Two questions added to the FAQ: how identity checks work when a license image has leaked, and a warning about contacts posing as the company and others (including that it has consulted the National Police Agency and a warning about calls from fake police).Oct 13
The two FAQ answers updated: more examples of extra identity-check steps (reading the IC chip, public personal authentication) and the laws and government materials the answers are based on.Oct 16
Fourth notice: the company reviewed its retention of identity-document images and changed its internal rules so that images are not kept after membership registration is complete. Images it currently holds will be deleted by the end of October 2026, whether or not the person asks. Saying the investigation is taking longer, it moved the update promised in about two weeks to Friday, October 23. Two FAQ questions added: why the disclosure is taking time, and how impersonation will be prevented once images are deleted.Oct 23
The outside forensic investigation ended and the fifth notice was published: final counts (6,628,007 records in the Times Car web system, 1,464,800 document images sent out, and more), unauthorized access to the related Times Club web system, the cause (exploitation of a vulnerability in the web system), a payment worth 3,000 yen, and measures to be published by the end of the year. From 17:00, each person's leaked items shown on My Page. FAQ updated with new questions on the payment and the fraud-alert system, among others.
- Investigation
- The outside forensic investigation ended on October 23. The counts given are final, based on its findings, and no further scope has been found so far
- Times Car web system (①)
- Name, address, date of birth, phone number, email address, driver's license information. Traces of attacker access and external transmission found for 6,628,007 records. Includes the contract details (name, phone, email) of people who joined Times Business Service through "Kantan Nyukai" and contract only for parking, paying by card
- Attribute and ID data (②)
- Corporate members' department names 3,677; Times Car member numbers (IC management numbers) 8; Times Business card numbers 113; linked-service IDs 4 (corrected from nine in the second notice; "JR West Group's membership service WESTER ID", listed in the second notice, was zero)
- Passwords (③)
- Hashed credentials (passwords) with traces of being sent out: 4
- Identity-document images (④⑤)
- Stored encrypted. Traces of being sent out: 1,464,800; accessed with no trace of being sent out: 891,602; total 2,356,402. The company had earlier said about 1.6 million might have leaked. A trace of external transmission does not mean the content immediately became viewable, but future decryption cannot be fully ruled out (the company)
- Types of images
- Driver's licenses, proof-of-address documents (such as utility bills), student IDs (student plan), family-verification documents (family plan) (as described in the October 1–16 versions of the FAQ)
- Times Club web system (⑥)
- Unauthorized access also found in connection with this incident. Traces of being sent out: name, address, date of birth and driver's license information 5; Times Club card numbers 19,510; Times Business card numbers 12; linked-service IDs (identifiers for linking with partner services) 135,436; credit card last four digits 28
- Other
- Identifiers used for member management and system operations also showed traces of access and external transmission
- Driver's license information
- Per the My Page display: license number, license type, expiry date (excluding images); internal identifiers for member management and system operation are also shown. Not listed in the fifth notice or FAQ (October 23 version); separate from document images
- Credit cards
- The company does not retain payment data and holds neither full card numbers nor security codes, so it says the cards cannot be misused
- Secondary harm
- As far as the company knows, no evidence the leaked data has been sold or published. It continues monitoring, including the dark web, with outside specialists
- Cause
- Judged to be the exploitation of a vulnerability in the web system. After getting in, the attacker searched the system for information and used what it obtained to access databases and file storage. Details of the method and system configuration are withheld to prevent further harm
- Countermeasures
- Measures for the confirmed intrusion route completed. Systems with the same configuration checked and patched; monitoring and detection strengthened
- Payment
- For people whose encrypted document images showed traces of access and external transmission, cash or vouchers worth 3,000 yen. Details and method still being decided; eligible people will be contacted
- Image retention (fourth and fifth notices)
- For current members, changed from "kept during membership" to "deleted immediately after registration checks are complete" (for former members, the current rule is "kept for seven years after leaving" and the new-rule cell shows only a dash). Images currently held will be deleted by the end of October 2026 whether or not the person asks. Information needed to check whether an image matches a previously stored image will be preserved. The company declines to detail its anti-impersonation measures after deletion for security reasons, but says they will not be relaxed (FAQ Q14)
- Next steps
- An investigation committee led by outside directors, with outside experts, will review internal control and governance. Specific information security and governance measures to be published by the end of the year
- Contact
- Hotline 0120-25-8924 (24 hours, Japan), the contact form on the official site, and the former-member form
How to read it: 'no sale or publication confirmed' does not mean 'safe'
The company says that, as far as it knows, there is no evidence the leaked data has been sold or published. That means nothing has been found yet, not that nothing will be used later. Nor does the encryption of the images settle it: the company itself has not ruled out future decryption.
Identity-document images in particular can still be misused years from now. Think of your precautions in years (CIC and JICC fraud alerts stay registered for five years).
Why the leaked license images are the most serious part
Things you can change or reissue
- Password (hashed here; 4 sent out; stop reusing it)
- Credit card (full numbers and security codes not held; last four digits leaked in 28 cases)
- Email address and phone number (a hassle, but changeable)
Things you cannot change yourself
- Name and date of birth
- Face photo
- Address (unless you move)
Data sent out (1,464,800 document images)
Encrypted images of driver's licenses and other documents, plus name, address and date of birth
↓ Someone applies in your name
Loan and credit card screening
Member companies check your credit file
Fraud alert (self-declaration) at all three bureaus
Member companies review applications more carefully. It does not block them
↓ If something is opened anyway
Cards or loans you never applied for
You may also notice through a collection notice or mail from a company you never used
Request your credit file
Once now and again a few months later. If you find something, contact that company and the police
A changed password makes the old one useless; identity-document images do not work that way. For online contracts in Japan, a common verification method has been simply sending a photo of your license plus a selfie.
The images in this case were stored encrypted. Encryption keeps data that has been taken from being read straight away; it does not stop it being taken. The company itself has not fully ruled out future decryption of the encrypted data that was sent out, so plan your precautions in years.
On reissuing the license: Article 94(2) of the Road Traffic Act lists grounds such as loss, destruction, soiling or damage; a leaked image is not named, so ask your local license center. A reissued license still carries the same name, date of birth and face, and this leak also included proof-of-address documents, so reissue alone does not solve the problem.
Image-only ID checks are being phased out, but not yet
Japan's anti-money-laundering rules (the Act on Prevention of Transfer of Criminal Proceeds), which cover things like opening bank accounts, were amended in June 2025 to abolish the remote method of sending an ID image plus a selfie, effective April 1, 2027. A further amendment in March 2026 makes reading the document's IC chip the norm for in-person checks too, from the same date.
Mobile phone contracts fall under a separate law; according to the Ministry of Internal Affairs and Communications, online contracts have required IC-chip reading in principle since April 1, 2026.
In its October 6 FAQ addition (updated October 13), the company also explains that when financial institutions verify identity remotely with a document image, they add steps such as a selfie match, reading the IC chip, public personal authentication or a check of a bank account in the person's name. It cites the Act on Prevention of Transfer of Criminal Proceeds and its ordinance, and the Mobile Phone Improper Use Prevention Act, as the basis. It does not fully rule out attempted fraudulent applications by third parties or impersonation in other contracts.
Until March 2027 for remote bank-type procedures, and for services outside these rules (many ask for a license image for age checks or sign-up), an image can still pass as ID. That is why this site recommends fraud alerts and credit-file checks.
Why former members' data was kept (the company's explanation), and deletion requests
The leak included former members and applicants who never completed registration. In its FAQ the company explains its retention as follows.
- Name, address and date of birth: kept for seven years under the Corporation Tax Act and other laws
- Driver's license information and images: kept for seven years for impersonation prevention and customer inquiries
In its fourth notice on October 16, repeated in the fifth notice on October 23, the company changed how it handles these images. It will no longer keep images once registration checks are complete, and will delete the images it currently holds by the end of October 2026, whether or not the person asks. The FAQ (updated October 23) keeps the seven-year retention of name, address and date of birth, and says retention rules for other data will also be reviewed, but gives no new periods yet.
On the legal side, Article 22 of the Act on the Protection of Personal Information asks businesses to make efforts to delete personal data without delay once it is no longer needed. This is a duty of effort; the business judges what period its purpose requires.
As for individuals' rights, Article 35(5) lets you request that use be stopped or data deleted in cases such as a reportable leak or when the business no longer needs the data. Records that must be kept by law may remain, but getting an answer on what remains and when it will be deleted is worth it on its own.
For those who run services that collect identity documents
In its fifth notice on October 23, the company attributes the breach to the exploitation of a vulnerability in its web system: after getting in, the attacker searched the system for information and used what it obtained to access databases and file storage (method details withheld). The images were encrypted, yet 1,464,800 showed traces of being sent out. The company also kept license information and images for seven years after members left, and has changed the rule so that images are not kept once registration checks are complete. What is necessary differs by business. With that said, three points are worth reviewing for any service that holds identity documents.
Set separate retention periods for the record of a check and the image used for it
After verification, operations usually need only when, with which document and by whom the check was done, plus the license expiry date. Decide item by item how long the image itself is needed and when the record alone is enough.
Set a deletion deadline for images of former members and unfinished applicants, and automate it
Document images of people who left or abandoned sign-up are not used day to day but are still in scope when a breach happens. Keep them for the legally required period if there is one, otherwise set a short deadline, and make them delete automatically when it passes. Manual deletion does not last.
Store images where the website's systems cannot read them directly
If the web system that takes sign-ups and bookings has free access to the image store with the same permissions, breaking the web side exposes the images too.
Keep images in a separate store with separate keys, and let the web side see only a "verified" result. In general, when an attacker who gets into the web system can use information found there to reach deeper data, encryption alone does not stop the data being taken. Separating the path to the store is needed in addition to encryption. The underlying ideas are covered in The minimum security baseline for organizations and Authentication vs. authorization.
After the disclosure
- Fraud-alert and disclosure requests flooded the credit bureaus CIC and JICC, causing delays and pauses in app-based applications (per the bureaus' notices).
- Lawyers opened a website recruiting participants for a class action, and registrations were reported to exceed 15,000 as of 9 p.m. on October 2 (Nikkei, October 2).
- Park24's share price was reported to have fallen after the disclosure; the company says the earnings impact is under review.
- In its October 1 FAQ, the company explained why it had kept former members' data.
- In its fourth notice on October 16, the company said it will no longer keep identity-document images after registration is complete and will delete the images it holds by the end of October.
- In its fifth notice on October 23, the company announced a 3,000-yen payment for people whose document images were sent out, a review by an investigation committee led by outside directors, and measures to be published by the end of the year.
For a comparison with other major Japanese breaches disclosed the same year, see Japan's major data breaches of 2026; for a case where the leaked data was not the images but the information around them, see the Gyazo breach.
Sources (public record)
The facts in this article come from the public sources below. Undisclosed methods or causes of the intrusion are not speculated on.
-
The My Page display of an affected member (checked October 27, 2026; a non-public screen, not a published company document): the items listed for driver's license information and the internal identifiers
-
Times Mobility Co., Ltd., fifth notice: report on the personal data leak caused by unauthorized access to the Times Car web system and next steps (October 23, 2026: final counts, Times Club web system, cause, payment, checking on My Page, Japanese) — share.timescar.jp / how to check (PDF): corp.timescar.jp
-
Times Mobility Co., Ltd., fourth notice on its response to unauthorized access to the Times Car web system (October 16, 2026: review of image retention, deletion of held images by the end of October, next update on October 23, Japanese) — share.timescar.jp
-
Times Mobility Co., Ltd., first notice on a possible personal data leak from unauthorized access to the Times Car website (September 25, 2026, updated October 1, Japanese) — share.timescar.jp
-
Times Mobility, second notice: investigation results and next steps (September 28, 2026, updated October 1, Japanese) — share.timescar.jp / page linked from the notice emails: corp.timescar.jp
-
Times Mobility, third notice (September 29, 2026, updated October 1: about 1.6 million accounts with identity-document images and start of individual emails, Japanese) — share.timescar.jp
-
Times Mobility, FAQ on unauthorized access to the Times Car website (October 1, 2026, updated October 6, 13 and 16; on October 23 the answers on leaked items, credit cards, checking and retention were revised to match the fifth notice, the questions on compensation and on the delay were removed, four questions on the payment, its eligibility, image transmission and the fraud-alert system were added, and all 14 were renumbered; Japanese) — corp.timescar.jp (PDF)
-
Park24 Co., Ltd., timely disclosure on unauthorized access at a consolidated subsidiary (September 28, 2026, Japanese) — park24.co.jp (IR)
-
JR West, notice on unauthorized access to the Times Car website (including follow-up, Japanese) — wester.jr-odekake.net
-
Fraud alerts (Japanese): CIC / JICC / Japanese Bankers Association credit information center
-
Congestion notices (Japanese): CIC (September 30) / JICC (October 2)
-
National Police Agency (JAFIC), Q&A on amendments to the ordinance of the Act on Prevention of Transfer of Criminal Proceeds (promulgated June 24, 2025 and March 6, 2026, Japanese) — npa.go.jp
-
Ministry of Internal Affairs and Communications, identity-verification rules for mobile phone contracts (Japanese) — soumu.go.jp
-
Road Traffic Act, Article 94 (license reissue, Japanese) — e-Gov Law Search
-
Act on the Protection of Personal Information, Articles 22 and 35 (Japanese) — e-Gov Law Search
-
Reporting: Nikkei on lawsuit-site registrations exceeding 15,000 (October 2, 2026, Japanese) — nikkei.com / Kyodo News via Okinawa Times (October 3, 2026, Japanese) — okinawatimes.co.jp
Update history
2026-11-02: Added what "driver's license information" includes, based on the member My Page display (shown to an affected member on October 27, 2026): license number, license type and expiry date (excluding images), plus internal management identifiers (FAQ, body text and facts list). The public fifth notice and FAQ (October 23 version) still do not list the items. As of the check on November 2, the company's news page (share.timescar.jp) shows no sixth notice, and no decision on how the consolation payment is made or completion report for image deletion.
2026-10-24: Reflected the October 23 fifth notice and FAQ update. Rewrote the title, description, bottom line, quick table, fact list, timeline and FAQ for the final counts (6,628,007 records in the Times Car web system; 1,464,800 document images sent out and 891,602 only accessed; 4 passwords; and more), the leak from the related Times Club web system (28 credit card last-four-digit records and more), the corrected linked-service ID count (nine to four; WESTER ID zero), the cause (exploitation of a vulnerability in the web system), the 3,000-yen payment, checking on My Page (from 17:00 on October 23) and the new URL of the former-member form. The "about 1.6 million accounts" figure is now treated as the number the company had described as possibly leaked at the time.
2026-10-16: Clarified that about 1.6 million counts accounts with document images, not image files. Corrected the FAQ so a negative image statement does not imply other data was taken for that individual. Rechecked the relevant third-notice and FAQ passages.
2026-09-29: First version, based on the notices of September 25 (first) and September 28 (second).
2026-09-30: Added the September 29 third notice (about 1.6 million accounts with identity-document images, start of individual emails).
2026-10-03: Added the October 1 FAQ and notice updates: a table of notice types, the former-member form, the seven-year retention explanation, that the company does not hold card data, that passwords are on the leaked list, credit-bureau fees and congestion, and the 2026 changes to anti-money-laundering and mobile-phone ID rules. Removed a reference to an "apology email to all members", which could not be confirmed. The company plans to report details in about two weeks; this article will be updated when it does.
2026-10-05: Updated the class-action registration count to more recent reporting (over 15,000 as of 9 p.m. on October 2).
2026-10-06: Added a link to the former-member inquiry form (from the October 1 update of the first notice).
2026-10-11: Added the two questions the company added to its FAQ on October 6 (how identity checks work when a license image leaks; a warning about impersonating contacts and the company's consultation with the National Police Agency). The cause was still undisclosed as of October 11.
2026-10-14: Reflected the October 13 FAQ update (IC chip reading and public personal authentication added to the examples of extra identity-check steps; legal references added). No fourth notice or cause had been published as of October 14.
2026-10-17: Reflected the October 16 fourth notice and FAQ Q11 and Q12 (images no longer kept after registration is complete, held images to be deleted by the end of October, next update moved to Friday, October 23). Added a "not yet known" box at the top. The counts are unchanged; the cause, findings and compensation were still undisclosed as of October 17.
Read next
- A newer case affecting drivers: unauthorized access to a road-service reception system (up to about 5.5 million records)
- What to do when your driver's license image or number leaks
- Image-based ID checks end in principle in April 2027: Japan's online ID checks move to IC-chip reading (preparing your PINs)
- ID numbers leaked: Lashinbang (secondhand buyback checks)
- Follow-on scams: What is phishing? / Fake virus warnings (tech-support scams)
- Passwords: Choosing a password manager / Choosing multi-factor authentication
- Protecting the phone you use for ID checks: Smartphone security basics
- The same pattern: Cariteco (Meitetsu Kyosho, car sharing) / Odido (Netherlands, passport and licence numbers) / AssuranceAmerica (US, licence numbers)
- Other incidents in Japan, September–October 2026: the Seicomart app (about 570,000 people) / Yamato Transport and Sagawa Express (parcel senders and recipients) / Abahouse (order data and fake refund emails) / Daiwa Securities (about 110,000 customers via a vendor)
- Other 2026 incidents: list of breaches and cyberattacks (Japan and worldwide) / Japan's major data breaches of 2026
- For operators: The minimum security baseline for organizations